Warmerly
Customer data hosted in the EU; privacy request form open to anyone
Warmerly
Warmly.ai
One-to-one · Privacy and data hosting
Privacy and data hosting
One row, in depth: what each tool does, the verified numbers, and who each suits.
Warmly.ai details read from its pricing, home, product, data, terms, privacy and security pages on 21 October 2026.
Warmerly
Customer data hosted in the EU; privacy request form open to anyone
Warmly.ai
SOC 2 listed on its security page; US company; hosting regions not stated
The short answer
Privacy and data hosting, in one look.
Warmerly states that customer data is hosted in the EU and makes no certification claim, so on certifications Warmly.ai is ahead. Warmly.ai's security page lists CCPA, EU Data Act, GDPR and SOC 2 as compliance badges, names Google Cloud Platform and Firebase as infrastructure and gives no hosting regions; its privacy policy says it is located in the United States. Warmerly publishes what happens to your data on cancelling or deleting, and runs a privacy request form open to anyone. Neither page set is legal advice. Last checked 21 October 2026.
Warmly.aiWarmly.ai ahead on this row
SOC 2 listed on its security page; US company; hosting regions not stated
The picture
Drawn side by side.
What each states about hosting and trust
Their own claims, unchecked by us
WarmerlyWarmly.ai
Hosted in the EU
- Data hosting: Hosted in the EU
- Certifications claimed: None
- Retention periods: 30 days for a deleted workspace; 6 years for tax records
SOC 2 listed, US company
- Data hosting: US company; regions not stated; Google Cloud and Firebase named
- Certifications claimed: SOC 2, GDPR, CCPA, EU Data Act listed as badges
- Retention periods: No specific periods
Warmerly claims no certification. Warmly.ai is ahead on certifications. Read both companies' policies and ask for a data processing agreement.
After you cancel, or ask for deletion
From each one's own pages
WarmerlyWarmly.ai
Warmerly
Cancel: workspace moves to FreeData keptDelete: 30 days to restoreThen permanently deleted
Warmly.ai
Request by webformIdentity checkResponse in 45 daysUp to 90 days with notice
Warmerly's lane is about a workspace you delete. Warmly.ai's is about a privacy request. They are different events, shown together to compare timings.
How Warmerly does it
Warmerly, in detail.
Warmerly keeps its claims narrow: EU hosting, a plain account of what is kept and deleted, and a request route for anyone, including people who are not customers.
01
Where customer data is hosted
Customer data is hosted in the EU. This is the only hosting claim we make: nothing about providers, regions, certifications or residency guarantees.
Warmerly product, checked 21 October 2026
02
No certifications claimed
Warmerly does not claim SOC 2, ISO 27001 or any other certification. We set nothing against Warmly.ai's SOC 2 listing.
Warmerly product, checked 21 October 2026
03
A request route open to anyone
The form at warmerly.com/privacy-request, or privacy@warmerly.com, needs no account and no reason. Options are know, access, correct, delete, object, and opt out of sale or sharing for California residents. Warmerly acts within one month, usually sooner, and says it does not sell customers' personal data.
Warmerly product, checked 21 October 2026
04
What happens when you cancel or delete
Cancelling deletes nothing: the workspace moves to Free. A deleted workspace is kept 30 days, can be restored without a card, then is permanently deleted. Mailbox passwords and tokens are deleted the moment you disconnect a mailbox, and synced inbox mail goes with it.
Warmerly product, checked 21 October 2026
05
What is kept longer, on purpose
Tax and accounting records are kept as long as the law requires, currently 6 years under UK law. Addresses that hard-bounced, or whose owner asked to be erased, stay on a platform-wide suppression list indefinitely so they are not emailed again.
Warmerly product, checked 21 October 2026
06
Sign-in and access
You can sign in with email and password, Google or Microsoft. Sign-in is blocked for a short while after too many wrong attempts, a session lasts up to 30 days, and changing your password signs out other sessions. Roles are Owner, Admin and Member, and an audit log records team, mailbox, billing and API key changes. We found no two-factor setting in the sign-in docs.
Warmerly product, checked 21 October 2026
07
Tracking is conservative by default
Open tracking is off by default, click tracking is on, and plain text mode removes both. Without a verified custom tracking domain, Warmerly adds no unsubscribe link of its own and sends in a no-link mode with a reply-to-unsubscribe line.
Warmerly product, checked 21 October 2026
08
Where Warmerly is behind
No certification, no hosting region named beyond the EU, and no two-factor setting that we found. The binding wording is in its Privacy Policy, DPA and sub-processor pages.
Warmerly product, checked 21 October 2026
How Warmly.ai does it
Warmly.ai, in detail.
Warmly.ai lists compliance badges and a security hub with gated documents, and its privacy policy describes visitor data collection and a US controller with few specifics.
01
Compliance badges
The security page lists CCPA, EU Data Act, GDPR and SOC 2. The SOC 2 report is behind a 'Get access' request. It lists no ISO certification and gives no dates for any certification or report.
security.warmly.ai · read 21 October 2026
02
Infrastructure and risk labels
The Infrastructure section names Google Cloud Platform and Firebase and gives no regions. The page shows Data Access Level 'Internal', Impact Level 'Low' and a Recovery Time Objective of '24 hours'.
security.warmly.ai · read 21 October 2026
03
Policies listed by title
Business Continuity and Disaster Recovery, Data Security, Incident Response and Software Development Lifecycle are listed. Only titles are visible without access.
security.warmly.ai · read 21 October 2026
04
Location, retention and subprocessors
The privacy policy, 'Last updated: July 12, 2025', says 'We are located in the United States' and that data may be processed outside the user's home country. It gives no specific retention periods, saying it keeps information 'for as long as necessary', and names no subprocessors.
warmly.ai/p/privacy-policy · read 21 October 2026
05
What is collected from website visitors
When its services run on a site it collects IP addresses, UTM parameters, form fill data, user agent, chat messages, pages visited and time on page, and matches online identifiers to third-party records such as name, job title and LinkedIn profile. Session-observing technology may capture clicks, mouse movements, scrolls and typing.
warmly.ai/p/privacy-policy · read 21 October 2026
06
Requests and opt-outs
Rights requests go through a webform, the cookie icon on the site or the Global Privacy Control signal. Warmly 'endeavor[s] to respond' within 45 days, extendable to 90. Its 2025 figures list 768 deletion requests and 457 opt-out requests, all complied with.
warmly.ai/p/privacy-policy · read 21 October 2026
07
Consent is the customer's job
Its terms say you must provide notices and 'obtain all consents from, individuals' where required, including for cookies and tracking, and that you are 'solely responsible for such disclosures and consents'. The first-party signals page says it does not use fingerprinting or non-consensual tracking.
warmly.ai/p/terms-of-service · read 21 October 2026
What Warmly.ai does not say
We looked, and found no statement on these. That is about its published pages only, not about the product.
- Hosting regions or an EU hosting option
- Specific retention periods
- Named subprocessors
- Dates, scope or validity of SOC 2 and other certifications, and any ISO evidence
- How consent is collected for visitor identification, or whether visitors can opt out on the site
- A service level or uptime figure
Where the sources disagree
We report each version rather than pick one.
- Warmly.ai's privacy policy is dated 'July 12, 2025' while its site footer shows 2026, so the policy date may not reflect the latest revision.
- Its data page says it honours opt-outs and deletes data on request, while its privacy policy gives no retention periods. We report both.
- Its security page lists 'GDPR' as a badge without detail, while its privacy policy says legal bases apply for UK, EEA and Swiss users. Consent is not listed as a standalone basis.
The numbers
Only what we could verify.
| Measure | Warmerly | Warmly.ai |
|---|---|---|
| Privacy and data hosting | Customer data hosted in the EU; privacy request form open to anyone | SOC 2 listed on its security page; US company; hosting regions not stated |
| Data hosting | Hosted in the EU | US company; regions not stated; Google Cloud and Firebase named |
| Certifications claimed | None | SOC 2, GDPR, CCPA, EU Data Act listed as badges |
| Retention periods | 30 days for a deleted workspace; 6 years for tax records | No specific periods |
| Time to act on a privacy request | Within one month | 45 days, extendable to 90 |
| Request route | Form open to anyone, no account | Webform, cookie icon, Global Privacy Control |
| Recovery time objective | Not stated here | 24 hours |
In practice
What it means for you.
Our reading of the facts above. Not a promise, and not the only reasonable reading.
If you need a SOC 2 report, Warmly.ai is the one to ask
Warmerly does not claim one. If a procurement team requires a SOC 2 report, Warmly.ai offers one on request, with the usual caution that you should read it, including scope and dates.
If you need EU hosting, ask both for it in writing
Warmerly states that customer data is hosted in the EU. Warmly.ai names no regions. Ask each for the regions, the subprocessors and a data processing agreement.
Visitor identification puts consent on you
Warmly.ai's terms make the customer responsible for notices and consents. Whether identifying a named person from a website visit is acceptable for you depends on your country and your consent set-up. Take legal advice before you rely on it.
A lead database is personal data too
Warmerly's lead database holds business contact details for companies. Both vendors describe request routes, and you remain responsible for having a lawful reason to email someone.
Who it suits
Pick the one that fits.
Warmerly
Warmerly is the better fit if
- You want customer data hosted in the EU, stated plainly
- You want to know exactly what is kept and deleted when you cancel
- You want a privacy request form that anyone can use without an account
Warmly.ai
Warmly.ai is the better fit if
- Your buyers ask for a SOC 2 report, and you will request and read it
- You want a security hub with listed policies and a stated recovery objective
- You have legal sign-off for identifying website visitors
Questions
Where does Warmerly host data?
In the EU. Warmerly makes no certification claim.
Is Warmly.ai SOC 2 certified?
Its security page lists SOC 2, GDPR, CCPA and EU Data Act as compliance badges. It names Google Cloud Platform and Firebase and gives no hosting regions.
How long does Warmerly keep deleted data?
30 days for a deleted workspace and 6 years for tax records.
How fast are privacy requests handled?
Warmerly acts within one month, and its form is open to anyone with no account. Warmly.ai says 45 days, extendable to 90.
Sources
Warmly.ai pages were read on 21 October 2026. Plans and wording change, so check the vendor's own page before you decide. Warmerly details come from the product as it runs today.
More features
See it on your own mailbox.
Connect a mailbox. Warmerly runs alongside whatever you send from now, so you can compare before you move anything.
Free plan, no card. Paid plans: 7-day trial, first charge on day 8.